Skip to content
Cloudflare API
Start here
API Reference
User

Tokens

List Tokens
user.tokens.list(TokenListParams**kwargs) -> SyncV4PagePaginationArray[Token]
GET/user/tokens
Token Details
user.tokens.get(strtoken_id) -> Token
GET/user/tokens/{token_id}
Create Token
user.tokens.create(TokenCreateParams**kwargs) -> TokenCreateResponse
POST/user/tokens
Update Token
user.tokens.update(strtoken_id, TokenUpdateParams**kwargs) -> Token
PUT/user/tokens/{token_id}
Delete Token
user.tokens.delete(strtoken_id) -> TokenDeleteResponse
DELETE/user/tokens/{token_id}
Verify Token
user.tokens.verify() -> TokenVerifyResponse
GET/user/tokens/verify
ModelsExpand Collapse
class TokenCreateResponse: …
id: Optional[str]

Token identifier tag.

maxLength32
condition: Optional[Condition]
request_ip: Optional[ConditionRequestIP]

Client IP restrictions.

in_: Optional[List[TokenConditionCIDRList]]

List of IPv4/IPv6 CIDR addresses.

not_in: Optional[List[TokenConditionCIDRList]]

List of IPv4/IPv6 CIDR addresses.

expires_on: Optional[datetime]

The expiration time on or after which the JWT MUST NOT be accepted for processing.

formatdate-time
issued_on: Optional[datetime]

The time on which the token was created.

formatdate-time
last_used_on: Optional[datetime]

Last time the token was used.

formatdate-time
modified_on: Optional[datetime]

Last time the token was modified.

formatdate-time
name: Optional[str]

Token name.

maxLength120
not_before: Optional[datetime]

The time before which the token MUST NOT be accepted for processing.

formatdate-time
policies: Optional[List[TokenPolicy]]

List of access policies assigned to the token.

id: str

Policy identifier.

effect: Literal["allow", "deny"]

Allow or deny operations against the resources.

One of the following:
"allow"
"deny"
permission_groups: List[PermissionGroup]

A set of permission groups that are specified to the policy.

id: str

Identifier of the permission group.

meta: Optional[PermissionGroupMeta]

Attributes associated to the permission group.

key: Optional[str]
value: Optional[str]
name: Optional[str]

Name of the permission group.

resources: Union[Dict[str, str], Dict[str, Dict[str, str]]]

A list of resource names that the policy applies to.

One of the following:
Dict[str, str]

Map of simple string resource permissions

Dict[str, Dict[str, str]]

Map of nested resource permissions

status: Optional[Literal["active", "disabled", "expired"]]

Status of the token.

One of the following:
"active"
"disabled"
"expired"
value: Optional[TokenValue]

The token value.

maxLength80
minLength40
class TokenDeleteResponse: …
id: str

Identifier

maxLength32
minLength32
class TokenVerifyResponse: …
id: str

Token identifier tag.

maxLength32
status: Literal["active", "disabled", "expired"]

Status of the token.

One of the following:
"active"
"disabled"
"expired"
expires_on: Optional[datetime]

The expiration time on or after which the JWT MUST NOT be accepted for processing.

formatdate-time
not_before: Optional[datetime]

The time before which the token MUST NOT be accepted for processing.

formatdate-time

TokensPermission Groups

List Token Permission Groups
user.tokens.permission_groups.list(PermissionGroupListParams**kwargs) -> SyncSinglePage[PermissionGroupListResponse]
GET/user/tokens/permission_groups
ModelsExpand Collapse
class PermissionGroupListResponse: …
id: Optional[str]

Public ID.

name: Optional[str]

Permission Group Name

scopes: Optional[List[Literal["com.cloudflare.api.account", "com.cloudflare.api.account.zone", "com.cloudflare.api.user", "com.cloudflare.edge.r2.bucket"]]]

Resources to which the Permission Group is scoped

One of the following:
"com.cloudflare.api.account"
"com.cloudflare.api.account.zone"
"com.cloudflare.api.user"
"com.cloudflare.edge.r2.bucket"

TokensValue

Roll Token
user.tokens.value.update(strtoken_id, ValueUpdateParams**kwargs) -> TokenValue
PUT/user/tokens/{token_id}/value